1
0
mirror of https://github.com/samba-team/samba.git synced 2025-01-25 06:04:04 +03:00

118690 Commits

Author SHA1 Message Date
Andreas Schneider
43a941f51b libcli:smb: Define SMB2_AES_128_CCM_NONCE_SIZE
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-08-21 09:57:31 +00:00
Andrew Bartlett
068da56a20 build: Remove explicit check for HAVE_GNUTLS_AEAD as we require GnuTLS 3.4.7
We strictly require it and if this were to fail we would want the compile to fail.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2019-08-21 09:57:31 +00:00
Andrew Bartlett
85a1c49739 s4-samdb: Remove duplicate encrypted_secrets code using internal Samba AES
We now rely on GnuTLS 3.4.7 or later.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2019-08-21 09:57:31 +00:00
Andrew Bartlett
e9859ad356 lib/crypto: Remove unused RC4 code from Samba
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2019-08-21 09:57:31 +00:00
Andrew Bartlett
2d54559aad s4-rpc_server/backupkey: consistently check error codes from GnuTLS
This uses the new gnutls_error_to_werror()

This should resolve Coverity 1452111 as forwarded by Volker.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2019-08-21 09:57:31 +00:00
Andrew Bartlett
52b91cb33c s4-rpc_server: Remove Heimdal-based BackupKey server
We rely on a modern GnuTLS now.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2019-08-21 09:57:31 +00:00
Andrew Bartlett
974cebdf95 build: Set minimum GnuTLS version at 3.4.7
This will soon be required for encrypted_secrets in the AD DC, the BackupKey server
and SMB2 as we remove use of the internal AES code.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2019-08-21 09:57:31 +00:00
Andreas Schneider
1f6104f09a lib:crypto: Prepare not to build AES or AES-CMAC if we use GnuTLS support it
Samba will soon require GnuTLS >= 3.4.7.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Adjusted by Andrew Bartlett from an earlier more comprehensive patch by Andreas

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2019-08-21 09:57:31 +00:00
Andrew Bartlett
fa8eddc39b auth/gensec: Use gnutls_error_to_ntstatus() in netsec_do_seal()
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2019-08-21 09:57:31 +00:00
Andreas Schneider
025f6a135f auth:gensec: Use GnuTLS AES CFB8 in netsec_do_seal()
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-08-21 09:57:30 +00:00
Andrew Bartlett
3b27fd8a49 auth/gensec: Use gnutls_error_to_ntstatus() consistently in schannel
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2019-08-21 09:57:30 +00:00
Andreas Schneider
58c781dc93 auth:gensec: Use GnuTLS AES128 CFB8 in netsec_do_seq_num()
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-08-21 09:57:30 +00:00
Andrew Bartlett
fefd95091c auth/credentials: Check NTSTATUS return from netlogon_creds_aes_encrypt()
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2019-08-21 09:57:30 +00:00
Andrew Bartlett
1aa249e7f4 s3-librpc: Remove unused init_netr_CryptPassword()
Unused since 38d4dba37406515181e4d6f1a1faffc18e652e27 in 2013

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2019-08-21 09:57:30 +00:00
Andrew Bartlett
1e427f55d7 s4-rpc_server: Check NTSTATUS return value from netlogon_creds_aes_decrypt()
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2019-08-21 09:57:30 +00:00
Andrew Bartlett
2f827bec8c s3-rpc_server: Check NTSTATUS return value from netlogon_creds_aes_decrypt()
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2019-08-21 09:57:30 +00:00
Andrew Bartlett
d515b255aa libcli:auth Check NTSTATUS from netlogon_creds_aes_{en,de}crypt()
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2019-08-21 09:57:30 +00:00
Andrew Bartlett
5ae119e7e9 crypto: Update REQUIREMENTS file with new minimum version
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2019-08-21 09:57:30 +00:00
Andrew Bartlett
8ec796f1a1 libcli:auth Return NTSTATUS from netlogon_creds_aes_decrypt()
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2019-08-21 09:57:30 +00:00
Andreas Schneider
a967285861 libcli:auth: Use GnuTLS AES128 CFB for netlogon_creds_aes_decrypt()
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-08-21 09:57:30 +00:00
Andreas Schneider
ded5aad21b libcli:auth: Return NTSTATUS for netlogon_creds_aes_encrypt()
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Adapted by Andrew Bartlett to use gnutls_error_to_ntstatus()

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2019-08-21 09:57:29 +00:00
Andreas Schneider
054efd118d libcli:auth: Use GnuTLS AES128 CFB for netlogon_creds_aes_encrypt()
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-08-21 09:57:29 +00:00
Andreas Schneider
cd97c47873 libcli:auth: Use netlogon_creds_aes_encrypt() in netlogon_creds_step_crypt()
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-08-21 09:57:29 +00:00
Andreas Schneider
20a42459df waf: Check for GNUTLS AES CFB support
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-08-21 09:57:29 +00:00
Andreas Schneider
d46e538d52 s4:samdb: Only include necessary header files in encrypted_secrets
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-08-21 09:57:29 +00:00
Andreas Schneider
7bf3c5d764 s4:samdb: Remove dual-stack mode from (test_)encrypted_secrets
Now we either build with GnuTLS or Samba crypto. If a modern GnuTLS
version is detected that will be used and Samba crypto wont be
available.

This removes the dual-stack mode that encrypted with one and decrypted
with the other in the testsuite.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Commit message clarified by Andrew Bartlett

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2019-08-21 09:57:29 +00:00
Andrew Bartlett
92b9cdf99d encrypted_secrets: Add known and expected value test
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2019-08-21 09:57:29 +00:00
Andreas Schneider
feccdebe15 s4:samdb: Add test_gnutls_value_decryption()
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-08-21 09:57:29 +00:00
Marco Wang
1b599e5c0d s3: net: net_ads: fix a typo in comment
Signed-off-by: Marco Wang <m.aesophor@gmail.com>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Wed Aug 21 08:39:43 UTC 2019 on sn-devel-184
2019-08-21 08:39:43 +00:00
Swen Schillig
fc4ad5b6df talloc: ASAN fix for test_magic_protection
Direct leak of 1152 byte(s) in 1 object(s) allocated from:
     #0 0x7f06393dfc08 in __interceptor_malloc (/lib64/libasan.so.5+0xefc08)
     #1 0x7f06392cfd59 in __talloc_with_prefix ../../talloc.c:782
     #2 0x7f06392cfd59 in _talloc_pool ../../talloc.c:837
     #3 0x7f06392cfd59 in talloc_pool ../../talloc.c:859
     #4 0x40b83c in test_magic_protection ../../testsuite.c:1960
     #5 0x40b83c in torture_local_talloc ../../testsuite.c:2164
     #6 0x402603 in main ../../testsuite_main.c:32
     #7 0x7f063908a412 in __libc_start_main (/lib64/libc.so.6+0x24412)

Signed-off-by: Swen Schillig <swen@linux.ibm.com>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Matthias Dieter Wallnöfer <mdw@samba.org>
2019-08-21 07:20:39 +00:00
Swen Schillig
d0933ec62c talloc: ASAN fix for test_rusty
Direct leak of 100 byte(s) in 1 object(s) allocated from:
     #0 0x7f06393dfc08 in __interceptor_malloc (/lib64/libasan.so.5+0xefc08)
     #1 0x7f06392d1af3 in __talloc_with_prefix ../../talloc.c:782
     #2 0x7f06392d1af3 in __talloc ../../talloc.c:824
     #3 0x7f06392d1af3 in __talloc_strlendup ../../talloc.c:2455
     #4 0x7f06392d1af3 in talloc_strdup ../../talloc.c:2471
     #5 0x40b4f0 in test_rusty ../../testsuite.c:1543
     #6 0x40b4f0 in torture_local_talloc ../../testsuite.c:2146
     #7 0x402603 in main ../../testsuite_main.c:32
     #8 0x7f063908a412 in __libc_start_main (/lib64/libc.so.6+0x24412)

Signed-off-by: Swen Schillig <swen@linux.ibm.com>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Matthias Dieter Wallnöfer <mdw@samba.org>
2019-08-21 07:20:39 +00:00
Swen Schillig
6c3e8a0a9f talloc: ASAN fix for test_pool_nest
Direct leak of 96 byte(s) in 1 object(s) allocated from:
    #0 0x7f06393dfc08 in __interceptor_malloc (/lib64/libasan.so.5+0xefc08)
    #1 0x7f06392d0c45 in __talloc_with_prefix ../../talloc.c:782
    #2 0x7f06392d0c45 in __talloc ../../talloc.c:824
    #3 0x7f06392d0c45 in _talloc_named_const ../../talloc.c:981
    #4 0x7f06392d0c45 in talloc_named_const ../../talloc.c:1748
    #5 0x40901e in test_pool_nest ../../testsuite.c:1451
    #6 0x40901e in torture_local_talloc ../../testsuite.c:2096
    #7 0x402603 in main ../../testsuite_main.c:32
    #8 0x7f063908a412 in __libc_start_main (/lib64/libc.so.6+0x24412)

Signed-off-by: Swen Schillig <swen@linux.ibm.com>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Matthias Dieter Wallnöfer <mdw@samba.org>
2019-08-21 07:20:39 +00:00
Swen Schillig
878e804df6 talloc: ASAN fix for test_talloc_free_in_destructor
Indirect leak of 104 byte(s) in 1 object(s) allocated from:
    #0 0x7f06393dfc08 in __interceptor_malloc (/lib64/libasan.so.5+0xefc08)
    #1 0x7f06392d0c45 in __talloc_with_prefix ../../talloc.c:782
    #2 0x7f06392d0c45 in __talloc ../../talloc.c:824
    #3 0x7f06392d0c45 in _talloc_named_const ../../talloc.c:981
    #4 0x7f06392d0c45 in talloc_named_const ../../talloc.c:1748
    #5 0x409edd in test_talloc_free_in_destructor ../../testsuite.c:1256
    #6 0x409edd in torture_local_talloc ../../testsuite.c:2138
    #7 0x402603 in main ../../testsuite_main.c:32
    #8 0x7f063908a412 in __libc_start_main (/lib64/libc.so.6+0x24412)

Signed-off-by: Swen Schillig <swen@linux.ibm.com>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Matthias Dieter Wallnöfer <mdw@samba.org>
2019-08-21 07:20:39 +00:00
Swen Schillig
616646a0c4 talloc: ASAN fix for test_realloc_on_destructor_parent
Direct leak of 96 byte(s) in 1 object(s) allocated from:
    #0 0x7fd52c00dc08 in __interceptor_malloc (/lib64/libasan.so.5+0xefc08)
    #1 0x7fd52befec45 in __talloc_with_prefix ../../talloc.c:782
    #2 0x7fd52befec45 in __talloc ../../talloc.c:824
    #3 0x7fd52befec45 in _talloc_named_const ../../talloc.c:981
    #4 0x7fd52befec45 in talloc_named_const ../../talloc.c:1748
    #5 0x4099bd in test_realloc_on_destructor_parent ../../testsuite.c:1000
    #6 0x4099bd in torture_local_talloc ../../testsuite.c:2129
    #7 0x402603 in main ../../testsuite_main.c:32
    #8 0x7fd52bcb8412 in __libc_start_main (/lib64/libc.so.6+0x24412)

Signed-off-by: Swen Schillig <swen@linux.ibm.com>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Matthias Dieter Wallnöfer <mdw@samba.org>
2019-08-21 07:20:39 +00:00
Jeremy Allison
f42642e54e s3: VFS: Complete the replacement of SMB_VFS_LINK() -> SMB_VFS_LINKAT().
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Böhme <slow@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Tue Aug 20 22:26:17 UTC 2019 on sn-devel-184
2019-08-20 22:26:17 +00:00
Jeremy Allison
fb75a3d5e9 s3: VFS: vfs_time_audit. Remove link_fn(). No longer used.
NB, this will now fail smb_vfs_assert_all_fns()
until we remove the rename_fn() from the VFS definitions.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Böhme <slow@samba.org>
2019-08-20 21:09:29 +00:00
Jeremy Allison
1b2440107f s3: VFS: vfs_full_audit. Remove link_fn(). No longer used.
NB, this will now fail smb_vfs_assert_all_fns()
until we remove the rename_fn() from the VFS definitions.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Böhme <slow@samba.org>
2019-08-20 21:09:29 +00:00
Jeremy Allison
d31d52f16d s3: VFS: vfs_unityed_media. Remove link_fn(). No longer used.
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Böhme <slow@samba.org>
2019-08-20 21:09:29 +00:00
Jeremy Allison
295aa5bd24 s3: VFS: vfs_syncops. Remove link_fn(). No longer used.
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Böhme <slow@samba.org>
2019-08-20 21:09:29 +00:00
Jeremy Allison
3c3e62b79e s3: VFS: vfs_snapper. Remove link_fn(). No longer used.
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Böhme <slow@samba.org>
2019-08-20 21:09:29 +00:00
Jeremy Allison
a591142956 s3: VFS: vfs_shadow_copy2. Remove link_fn(). No longer used.
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Böhme <slow@samba.org>
2019-08-20 21:09:29 +00:00
Jeremy Allison
38da902351 s3: VFS: vfs_media_harmony. Remove link_fn(). No longer used.
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Böhme <slow@samba.org>
2019-08-20 21:09:29 +00:00
Jeremy Allison
751852ced4 s3: VFS: vfs_glusterfs. Remove link_fn(). No longer used.
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Böhme <slow@samba.org>
2019-08-20 21:09:29 +00:00
Jeremy Allison
f9c3b0b3cf s3: VFS: vfs_ceph_snapshots. Remove link_fn(). No longer used.
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Böhme <slow@samba.org>
2019-08-20 21:09:29 +00:00
Jeremy Allison
228423811c s3: VFS: vfs_ceph. Remove link_fn(). No longer used.
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Böhme <slow@samba.org>
2019-08-20 21:09:29 +00:00
Jeremy Allison
45851ead18 s3: VFS: vfs_cap. Remove link_fn(). No longer used.
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Böhme <slow@samba.org>
2019-08-20 21:09:29 +00:00
Jeremy Allison
ea637f002d s3: smbd: Make hardlink_internals() call SMB_VFS_LINKAT() instead of SMB_VFS_LINK()
Use conn->cwd_fsp as current src and dst fsp's.

No logic change for now.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Böhme <slow@samba.org>
2019-08-20 21:09:29 +00:00
Jeremy Allison
d4f3d6ce12 s3: torture: Change cmd_link to call SMB_VFS_LINKAT().
Use conn->cwd_fsp as current src and dst fsp's.

No logic change for now.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Böhme <slow@samba.org>
2019-08-20 21:09:28 +00:00
Jeremy Allison
6b6298b023 s3: VFS: vfs_unityed_media. Implement linkat().
Currently identical to link().

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Böhme <slow@samba.org>
2019-08-20 21:09:28 +00:00
Jeremy Allison
a14d825a25 s3: VFS: vfs_time_audit. Implement linkat().
Currently identical to link().

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Böhme <slow@samba.org>
2019-08-20 21:09:28 +00:00